Point the restore link at HA's new backup page and lock in credential redaction

The restore link sent users to the hassio/backups panel, which Home
Assistant removed in 2025.1 when backups moved to Settings > System >
Backups (issue #1151).  The link now picks the right page based on the
Home Assistant version, assuming a current version when unknown.

Credential redaction in the UI server's error logging (issue #1001) was
already implemented; this adds test coverage for the original report's
repro path and for redaction of serialized credentials on the OAuth
return route.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sabeechen

hassio-google-drive-backup/CHANGELOG.md

@@ -1,5 +1,7 @@
 ## v0.113.0 [unreleased]
 
+- The web UI's "restore" link now points at Settings > System > Backups on Home Assistant 2025.1 and later, where the backup page moved.  Older versions still get the old link.
+- User-supplied Google API credentials (and serialized tokens) are redacted from the addon's logs when a request fails.
 - The addon now recognizes backups created by Home Assistant's own automatic backup schedule (added in Home Assistant 2025.1) and, on new installs, ignores them by default so it never deletes backups that Home Assistant's retention settings are managing.  Existing installs keep the old behavior unless the new `ignore_automatic_backups` option is enabled, since some users may rely on those backups being uploaded to Google Drive.
 - Clicking "Never Delete" on an ignored backup now also un-ignores it, so you no longer have to click "Don't Ignore" first and race the next sync's deletions to keep an ignored backup forever.
 - Updated the addon to Python 3.14 with pinned, reproducible dependencies.

hassio-google-drive-backup/backup/ha/hasource.py

@@ -482,6 +482,17 @@ def getHomeAssistantUrl(self):
             return ""
         return self._haUrl()
 
+    def getHomeAssistantVersion(self):
+        if self.ha_info is None:
+            return None
+        version = self.ha_info.get("version", None)
+        if version is None:
+            return None
+        try:
+            return Version.parse(version)
+        except (ValueError, TypeError):
+            return None
+
     def _haUrl(self):
         if self._info.ha_ssl:
             protocol = "https://"

hassio-google-drive-backup/backup/ui/uiserver.py

@@ -39,6 +39,9 @@
 MIME_JSON = "application/json"
 VERSION_CREATION_TRACKING = Version(0, 104, 0)
 
+# Home Assistant 2025.1 moved backups from the old "hassio/backups" panel to Settings > System > Backups.
+VERSION_HA_BACKUP_PANEL_MOVED = Version(2025, 1)
+
 
 @singleton
 class UiServer(Trigger, Startable):
@@ -103,7 +106,12 @@ async def buildStatusInfo(self):
         for backup in backups:
             status['backups'].append(self.getBackupDetails(backup))
         status['ha_url_base'] = self._ha_source.getHomeAssistantUrl()
-        status['restore_backup_path'] = "hassio/backups"
+        ha_version = self._ha_source.getHomeAssistantVersion()
+        if ha_version is not None and ha_version < VERSION_HA_BACKUP_PANEL_MOVED:
+            status['restore_backup_path'] = "hassio/backups"
+        else:
+            # When the version is unknown, assume a current Home Assistant.
+            status['restore_backup_path'] = "config/backup/backups"
         status['ask_error_reports'] = not self.config.isExplicit(
             Setting.SEND_ERROR_REPORTS)
         status['warn_ingress_upgrade'] = False

hassio-google-drive-backup/dev/simulated_supervisor.py

@@ -55,6 +55,7 @@ def __init__(self, config: Config, ports: Ports, time: Time):
         self._password = "pass"
         self._addons = all_addons.copy()
         self._super_version = Version(2023, 7)
+        self._core_version = Version(2026, 7)
         self._mounts = {
             'default_backup_mount': None,
             'mounts': [
@@ -275,8 +276,8 @@ async def _coreInfo(self, request: Request):
         await self._verifyHeader(request)
         return self._formatDataResponse(
             {
-                "version": "1.3.3.7",
-                "last_version": "1.3.3.8",
+                "version": str(self._core_version),
+                "last_version": str(self._core_version),
                 "machine": "VS Dev",
                 "ip_address": "127.0.0.1",
                 "arch": "x86",

hassio-google-drive-backup/tests/test_uiserver.py

@@ -13,10 +13,12 @@
 from aiohttp.client import ClientSession
 
 from backup.file import File
+from backup.logger import getHistory
 from backup.util import AsyncHttpGetter, GlobalInfo, DataCache, UpgradeFlags
 from backup.ui import UiServer, Restarter
-from backup.config import Config, Setting, CreateOptions
+from backup.config import Config, Setting, CreateOptions, Version
 from backup.const import (ERROR_CREDS_EXPIRED, ERROR_EXISTING_FOLDER,
+                          ERROR_GOOGLE_CRED_PROCESS,
                           ERROR_MULTIPLE_DELETES, ERROR_NO_BACKUP,
                           SOURCE_GOOGLE_DRIVE, SOURCE_HA)
 from backup.creds import Creds
@@ -29,6 +31,7 @@
 from .helpers import compareStreams
 from yarl import URL
 from dev.ports import Ports
+from dev.request_interceptor import RequestInterceptor
 from dev.simulated_supervisor import SimulatedSupervisor
 from dev.simulationserver import SimulationServer
 from dev.simulated_google import SimulatedGoogle
@@ -1200,3 +1203,32 @@ async def test_oob_warning(reader: ReaderHelper, ui_server: UiServer, config: Co
 @pytest.mark.asyncio
 async def test_url_sanitize(ui_server: UiServer):
     assert ui_server._sanitize(URL("http://localhost/test?client_id=im_a_secret&client_secret=im_a_secret&ignore=shown")) == URL("http://localhost/test?client_id=redacted&client_secret=redacted&ignore=shown")
+    assert ui_server._sanitize(URL("http://localhost/token?creds=im_a_serialized_refresh_token&host=shown")) == URL("http://localhost/token?creds=redacted&host=shown")
+
+
+@pytest.mark.asyncio
+async def test_manualauth_error_redacts_credentials(reader: ReaderHelper, interceptor: RequestInterceptor):
+    """Credentials passed to manualauth must never reach the logs when a request fails (issue #1001)"""
+    interceptor.setError("/device/code", status=401)
+    await reader.assertError("manualauth?client_id=super_secret_id&client_secret=super_secret_value", error_type=ERROR_GOOGLE_CRED_PROCESS)
+    logs = "\n".join(line for _, line in getHistory(0, False))
+    assert "Error serving" in logs
+    assert "super_secret_id" not in logs
+    assert "super_secret_value" not in logs
+    assert "client_secret=redacted" in logs
+
+
+@pytest.mark.asyncio
+async def test_restore_link_current_ha(reader: ReaderHelper):
+    """Home Assistant 2025.1 and later hosts backups at Settings > System > Backups (issue #1151)"""
+    status = await reader.getjson("getstatus")
+    assert status['restore_backup_path'] == "config/backup/backups"
+
+
+@pytest.mark.asyncio
+async def test_restore_link_old_ha(reader: ReaderHelper, supervisor: SimulatedSupervisor, ha: HaSource):
+    """Home Assistant older than 2025.1 uses the old hassio/backups panel"""
+    supervisor._core_version = Version(2024, 12)
+    await ha.refresh()
+    status = await reader.getjson("getstatus")
+    assert status['restore_backup_path'] == "hassio/backups"